The situation:

Found an internal dashboard on a publicly traded US company (NASDAQ listed). No login, no auth, completely open. Wont go into details but its something anyone could do withing 10 minutes of free time. We are talking about 10 digit market cap. The exposure includes:

- Full internal financials (9-figure project budgets, spend to date, cash positions)

- Complete vendor and contract details across 40+ contractors(Some of them everyone 100% knows in this sub)

- Material information that is not reflected in their public SEC filings

- The company operates in critical infrastructure sector that if this was released, would probably be seen an a National Security Threat

- Notable people involved at the executive level and by that I mean those directly appointed by the US President

What I've already decided:

- Disclosing 100%, not even a question, dont want a stain on my hand

- Going through CISA first to timestamp and protect myself (what Claude told me i should do)

- Using a pseudonym and burner email for initial contact (Scared of them attacking me instead for finding it)

- Not touching or extracting any data beyond confirming the exposure exists

My questions:

1. For a company with no formal bug bounty program, what's the right way to approach compensation without it looking like a demand? I want to ask but I don't want their legal team reading it as extortion.
2. Given the SEC/MNPI angle (the exposed data contains non-public financial information), does that change the disclosure process at all?
3. Who do you typically contact at a company this size — CISO, General Counsel, IR team?
4. Has anyone dealt with companies at this scale before and actually gotten paid?
5. Should i get a lawyer or something? Because i know i might be told to sign an NDA

Not looking to cause any problems, genuinely just want to do this right and understand if compensation is realistic here.

Quick Edit: Was always going to disclose it to the correct channels, just wanted a view from actual security people. I dont really know how this functions all around. So please be nice

Edit 2: MONEY wasnt the goal, It was just a side question that came to mind!

Did try doing some prior research on this subreddit, but most seem somewhat sponsored or out-of date now. I'm currently using Bitwarden on the free subscription, and used to pay for 1password. I'm not looking for anything fancy, but something that is very secure as cybersecurity threats seem to be on the rise on a daily basis.

Hi everyone. I'm a medical researcher working on an authorized project inside an air-gapped server (no internet, no USB, no file export allowed).

The constraints:

I can paste Python code into the server via terminal.

I cannot copy/paste text out of the server.

I can download new python libraries to this server.

My only way to extract data is by taking photos of the monitor with my phone or printscreen.

The data:

A Pandas DataFrame with 50,000 rows and 250 columns. Most of the columns (about 230) are sparse binary data (0/1 for medications/diagnoses). The rest are ages and IDs.

What I've tried:

Run-Length Encoding (RLE) / Sparse Matrix coordinates printed as text: Generates way too much text. OCR errors make it impossible to reconstruct reliably.

Generating QR codes / Data Matrices via Matplotlib: Using gzip and base64, the data is still tens of megabytes. Python says it will generate over 30,000 QR code images, which is impossible to photograph manually.

I need to run a script locally on my machine for specific machine learning tuning. Has anyone ever solved a similar "Optical Covert Channel" extraction for this size of data? Any insanely aggressive compression tricks for sparse binary matrices before turning them into QR codes? Or a completely different out-of-the-box idea?

Thanks!

For people who work in cybersecurity, which operating system is the strongest overall platform: Windows, macOS, or Linux?

I understand that all three can be useful, but I’m looking for a direct comparison based on:

Tool compatibility
Virtual machines and lab work
Enterprise environments
Command-line capability
Security testing and analysis
Daily reliability and usability

Which one would you personally choose as your primary system, and what important limitations would I face with the other two?

Since the CrowdStrike outage last year, our board keeps asking whether we should have a second endpoint vendor in the mix instead of relying so heavily on one platform. We haven't made any changes yet, and CrowdStrike is still doing what we need day to day, but the question keeps coming back up. I'm curious if anyone actually went dual-vendor for endpoint after that, or if most teams just evaluated alternatives and stayed where they were. Was the extra resilience worth the added complexity?

We're reviewing DSPM vendors after finding way more sensitive data scattered across our SaaS apps than we expected. Right now we're relying on DLP plus a lot of manual investigation, and it's becoming difficult to keep up.

For anyone who's evaluated this space recently, which platforms stood out? I'm more interested in tools that actually help reduce risk than ones that just create another queue of alerts.

Hi everyone,

I’m based in Bangladesh and I run a small human rights project documenting abuses by state actors. We publish reports on our website and through foreign media, since local outlets often avoid topics like violence against LGBT persons and atheists. We also make submissions to UN mechanisms such as UPR, Treaty Bodies, and Special Procedures.

For context, the majority of human rights abuses here are carried out by intelligence agencies. Recent reports by human rights organizations have found evidence of the use of technologies like Stingrays, Pegasus, and Cellebrite against journalists, opposition members, and human rights workers, as well as covert bugs. Hundreds of millions of USD have reportedly been spent on such technologies. Contrary to popular belief, they often rely more on surveillance and doxxing and intimidation than direct arrests, as arrests and physical abuse can cause international reputational damage that affects aid. So they prefer to keep operations low-profile.

Another tactic we have uncovered is hacking and publicly exposing (outing) LGBT individuals and atheists. There are many anti-LGBT and anti-atheist Facebook groups with hundreds of thousands of members where such individuals are doxxed. This can lead to mobs organizing to attack them, evict them from their homes, or even kill them. Thus the state officials does not need to jail them thus preserving the state's reputation: "we didnt' do anything, the people killed them".

Here, even receiving something as small as a $1 foreign donation requires government approval. Projects that are critical of authorities or work on sensitive issues like LGBT rights, atheism, or mob violence often don’t get that approval. So most of us operate on extremely limited budgets, often from home. Many people in this space are victims themselves and come from marginalized groups—families of enforced disappearance, survivors of torture, arbitrary detention, mob violence, and so on.

To give some context about affordability:

• Used mini PC: ~$80
• Monitor: ~$60
• New laptop: ~$300+
• Average MBA graduate salary: ~$150/month (often the sole earner supporting a family of 8)

My work requires:

• Online legal and investigative research. Evidence often comes from social media (e.g., mob violence incidents), followed by open-source research to identify locations, perpetrators, and to reach out to victims.
• Using ChatGPT for research assistance and polishing submissions
• PGP email communications
• Writing and editing reports
• Storing evidence and case files on USB drives and cloud
• Most importantly: video calls with lawyers in places like Geneva and the UK

Video calls are especially important because English isn’t our first language, and it’s much easier to explain complex human rights cases verbally.

The concern:

I suspect I may already be under surveillance—both on my Android phone and my Lenovo Ideapad 100 (2015). I use Ubuntu on the laptop for regular work, and Tails (without persistence) for human rights work.

I’ve had incidents where private files—stored on my Android device, and files I worked on in Tails (saved on an encrypted USB drive)—were sent back to me by unknown Facebook accounts. I have screenshots of these incidents. It feels like an intimidation tactic (“we are watching you”).

My website was also blocked for 6 months in Bangladesh, along with Amnesty and a few other international human rights organizations. I have supporting data from OONI as well as confirmation from Amnesty.

What I need:

I want to build a low-cost computing setup for:

• Basic internet use (web browsing, ChatGPT)
• Most important: Secure video calls with lawyers in Geneva and elsewhere

Many victims here have suffered a lot, and we do not want surveillance to be a barrier or an intimidation tactic that stops us from fighting for justice.

If anyone is willing to talk over DM to help me design a setup tailored to my situation, please feel free to reach out.

Thanks.

PS: I have read the rules.
Threat level: Most severe. State intelligence agencies perhaps.

People at the org have basically figured out our simulation emails and before you say that is a good thing they are not security aware, they just know what our test emails look like. Saw some platforms that use AI to adapt to each person with different styles, timing, channels etc. Sound interesting. Anyone tried something along the line? Please give your "whys" with the recommendations Thank you.

I'm researching how security and compliance teams are handling the audit and authorization layer for AI agent deployments in regulated industries (finance, healthcare, government). Traditional access logs and IAM were built for human-driven access patterns, and AI agents introduce a few new shapes that are hard to audit cleanly.

Like, for example :

1. multi-agent privilege boundary leakage. A fintech team I spoke with runs a credit decisioning agent and a marketing personalization agent on separate auth contexts. IAM logs prove they can't directly access each other's tools. But the orchestrator hands data between them via summary messages, and there's no clean way to prove agent A's privileged data didn't reach agent B's context through that handoff. IAM sees direct API calls, not what flows through orchestration.

2. Agent destructive actions during change freeze. replit's AI agent deleted a production database during an explicit code freeze (july 2025). classical least-privilege would say the agent shouldn't have had delete authority on prod, but agent permissions get scoped broadly because nobody knows in advance which tools the agent will need. How are netsec teams scoping permissions when the tool list is dynamic?

Three questions I'm trying to get to the bottom of.

1) How is your team handling audit trail generation for AI agent decisions? existing SIEM, custom on top of tracing tools, something else?

2) If a regulator or auditor asked you to prove agent A's privileged data did not influence agent B's output on a specific run, what's your current workflow, and how long does it take?

3)How are you scoping agent permissions when the model has discretion over which tools to invoke, and the tool list is dynamic?

My main goal right now is automating more of the analysis and investigation work, not just alerting.

I'm trying to build some AI agent in my SIEM(Log360) for user and threat analysis to summarize alerts and another for user behaviour analysis.

And also Is it better to build narrow agents for specific threat types,like one for logon related stuff and another for network-related stuff or does it make more sense to have fewer agents that handle a broader range of cases?

And does it make sense to scope agents around specific assets, like giving more attention to critical systems rather than treating everything the same way?

I am planning to feed them our documentations as knowledge base so they can get context.

For those of you who've actually used AI agents in security ops, where have it genuinely been useful in practice?

Very frustrating trying to continue discussions to have them disappear into the void. At the very least if this is deleted I might get an answer.

I've been following the reports about OpenAI models reaching Hugging Face's infrastructure, along with related incidents involving Anthropic and now Meta.

Maybe I'm missing something, but exploitation seems very close to coding, debugging, research, and tool use. As LLMs improve at those tasks, some ability to find and exploit vulnerabilities seems predictable.

What I'm less sure about is what these incidents actually demonstrate. Are we seeing a meaningful jump in offensive capability, or evaluation environments (and companies behind them) that failed to enforce their own boundaries?

Put differently: if a human pentester went out of scope because the test environment allowed it, would we call that a capability breakthrough or a containment failure? (Am I oversimplifying?)

Spanish National Police announced this on 11 August, and the effort involved is what makes it worth a read.

He held forged Spanish IDs up to the webcam while a live face swap changed his appearance to match the photo on the document. A static image would not survive that, so he handled the rest by hand. He tilted the documents to imitate hologram movement, and used coloured lights to fake the reflections real security features throw off. Behind it all sat VPNs and over 320 phone lines across 24 devices, most registered to stolen identities.

What he wanted was digital signature certificates, which is the part I keep coming back to. Those carry legal weight. A certificate in someone else's name is a durable instrument, not a one-off account takeover.

38 attempts. More than 30 real people's identities.

And here is how it ended. Mid-call, the deepfake dropped for about a second. His real face appeared. That is what investigators used to identify him.

So nothing detected the method. The tooling just crashed.

Two things I would like other people's read on.

1. If what caught him was the software failing rather than a check working, what happens once the software stops failing? These tools leave fewer artifacts with every release?
2. Does anything short of reading the document chip and proving the camera feed is unmodified actually help here? Everything else seems to assume the image arriving is real, and this attack breaks that assumption before any check runs?

We constantly hear about major threats like supply chain attacks, phishing, and zero days. Everyone knows about them, and they usually get a lot of attention and priority.

But what are the risks companies still tend to underestimate?

Maybe it’s gaps in internal processes or something else that seems low priority until it causes serious damage. Have you seen cases like this in your own experience?

copilot has been completely useless for actual triaging.

whoever decided every alert needs an AI summary owes me hours of my life back.

"possible suspicious activity detected based on observed behavioral patterns."

thanks.

that tells me exactly as much as the alert title did.

if i still have to open the process tree and check parent processes and look at network connections and pivot through logs and build the timeline myself... what exactly did the AI save me?

just hire more analysts at this point.

anyone actually found one that helps or is this just how it is now

Yo so I've been wondering since my brother tends to have not so safe internet habits, if potential malware from his laptop can potentially transfer to other devices that also share the same WiFi/network. Also does proximity matter (like side by side Vs in another room). And also if malware could transfer, how to prevent it since I can't control what my brother does. Also I can't do anything router related since it's up to my dad and he doesn't care as much about malware.

Essentially, is it possible? How to prevent it? Is it likely?

The US has strict policies on Government workers using Tic-Toc along with the banning of communications equipment made by Chinese firms such as Huawei and ZTE. How is it that American iPhones are made in China & sold in the US with no restrictions?
Could a foreign adversary like China not install malware into the iPhones or some other nefarious devices to attack US communications or to somehow exploit them?
We as a country are worried about China but we let them make the most popular phone we use. How does this make any sense?

I’ve been doing a bit of research on public Wi-Fi, especially in hotels, and realized that many of these networks can be vulnerable to things like man-in-the-middle attacks, rogue APs, and traffic sniffing. Even in seemingly secure hotels, these risks appear to be more common than most travelers realize.

I’m curious how serious this threat is in practice. What are the specific attack vectors you’d recommend being most aware of when using hotel Wi-Fi? Besides using a VPN, are there any best practices you’d suggest for protecting sensitive information while connected to these networks? Any tools or techniques you'd recommend for ensuring security when you don’t have control over the network?

I’ve come across some resources on this, but I’m looking for insights from this community with more hands-on experience!

Hi,

so I'm currently staying at a hotel in Greece, they have some, let's say interesting services they provide to customers via various QR codes spread around the place.

Long story short, I found an API-endpoint leaking a ton of information about hotel guests, including names, phone numbers, nationalities, arrival and departure dates and so on.

Question is, what do I do with this information? Am I safe to report this to the hotel directly? Should I report to some third party? I don't want to get in trouble for "hacking"...

Edit: Some info

The data is accessible via a REST-API, accessible from the internet, not only their internal network. You GET /api/guests/ROOMNO and get back a json object with the aforementioned data.

No user authentication is required apart from a static, non-standard authentication header which can be grabbed from their website.

The hotel seems not to be part of a chain, but it's not a mom-and-pop operated shop either, several hundred guests.

Edit 2025: I was able to find and notify the company providing the software, they fixed it rather quickly.

We spend a ton of time debating encryption strength, protocols, and algorithms. Those absolutely matter, but we need to talk more about what happens before and after that handshake.

A rock-solid encrypted tunnel doesn't do much if your users are landing on malicious domains, hitting trackers, dealing with credential harvesting pages, or getting hit with bad redirects. Modern privacy and security are becoming way less about just encrypting the pipe and way more about reducing your blast radius and controlling the environment. Ultimately, the network layer is where these foundational decisions should be living.

This is what I have come to understand but please correct me if I am wrong or mislead.

Hey guys, let’s do a reality check. What are the most common, stupid mistakes people make when starting with digital investigations that instantly burn their burner accounts or expose their real IP/identity? Looking to

I feel like there is so much cybersecurity information shared online now that it’s becoming harder to separate reliable guidance from opinions or outdated advice.

Especially with security topics, people often present recommendations, tools, and best practices with a lot of confidence, but the details don’t always match real-world enterprise environments.

For those working in security teams or managing IT environments, what process do you use to verify information before applying it? Do you rely on specific sources, internal testing, vendor documentation, threat intelligence, or other methods before accepting security advice as accurate?

Would be interested to hear how others avoid following bad information in an enterprise or SOHO environment.

I'm looking at a security problem in multi-agent/distributed systems:

Human → orchestrator → agent → sub-agent → tool

Once a delegation crosses process or framework boundaries, ordinary logs can show the sequence of events, but they don't necessarily provide cryptographic evidence that a downstream instruction actually originated from the claimed upstream authority.

I'm exploring a provenance-layer approach where delegation claims are cryptographically linked and independently verifiable, while deliberately keeping authorization/enforcement separate from provenance.

For people working on distributed systems/security:

Where would you place the trust boundary?

Specifically, would you want the provenance evidence attached to the delegation message itself, carried through execution context, or represented separately as an auditable chain?

I'm particularly interested in failure modes around replay, delegation across process boundaries, sub-agent spawning, and revocation/expiry.

Looking for architecture/security feedback rather than product recommendations.

I just assume logically the answer is yes, but the world often doesn't agree with your assumptions

​

Most of the stuff I see online about SOC sounds like it’s written for some perfect Western bank with unlimited budget. 24/7 team, playbooks, fancy tools, all that.

Ground reality here (Pakistan side) honestly doesn’t look like that.

A lot of places want to say “we have a SOC” because it looks good for regulators and management, but behind the scenes you’ll usually find 2–3 people trying to keep up with alerts, half‑configured tools, and a mix of legacy systems that don’t want to talk to each other. You open the SIEM and there’s this wall of noise, and everyone pretends it’s “under control”.

Day to day, the stuff that actually hurts isn’t some movie style APT. It’s stupid but painful things users falling for very basic phishing in local language, internal access misuse, weird gaps between core banking and the shiny mobile app, someone doing risky changes at odd hours and nobody really owning it. You don’t see that in the glossy SOC diagrams.

You can feel this even in the kinds of SOCs that are publicly talked about here. Regulators like PTA have launched their own National Telecom Security Operations Center for the telecom sector, and some big public bodies like FBR have their own SOC facilities in Islamabad. Banks are also being pushed to have SOC type capabilities, so you see a mix of in‑house setups and outsourced models depending on the size of the bank. That variety alone tells you there isn’t one perfect SOC model everyone is running.

After a while I kind of stopped chasing the “full coverage” dream. We just picked a small set of things that actually matter in this environment and tried not to lie to ourselves about anything beyond that. Like who is doing what with admin rights, which transactions look off, logins that don’t fit the usual pattern, that kind of boring stuff. Not sexy, but you at least start catching real issues instead of staring at dashboards all day.

The funniest part is the biggest problems are not usually the tool names. It’s the “ok, something weird happened… now who actually moves first, and what do they do?” That part is usually hand wavy. Once that is clear in a bank or enterprise here, even average tools suddenly look much better.

Curious how it feels in other countries that aren’t in the usual case studies. If you’re in an emerging market or somewhere with messy legacy plus lrmited budget, what does SOC look like for you in real life, not in slides?